fix(tools): add --no-sandbox for CI environments

Puppeteer's Chrome requires --no-sandbox on GitHub Actions runners
where unprivileged user namespaces are restricted by AppArmor.

Assisted-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: bennypowers

tools/pfe-tools/test/config.ts

@@ -87,6 +87,9 @@ export function pfeTestRunnerConfig(opts: PfeTestRunnerConfigOptions): TestRunne
     browsers: [
       chromeLauncher({
         puppeteer: puppeteer as never,
+        launchOptions: {
+          args: process.env.CI ? ['--no-sandbox'] : [],
+        },
         createBrowserContext: async ({ browser }) => {
           const context = await browser.defaultBrowserContext();
           await context.overridePermissions('http://localhost', [